5.1 Policies for information security
An overarching information security policy and a set of topic-specific policies are to be written, signed off by management, made available, brought to the attention of the staff and outside parties they concern, confirmed as received by those people, and revisited on a schedule and whenever something significant changes. Purpose: keep management's direction on information security fit, sufficient and working, in line with business, legal, regulatory and contractual needs. Guidance: top management approves the top-level policy, which states how the organization runs information security and draws on business strategy, laws and contracts, and present and expected risks and threats. It should cover what information security means for the organization, its objectives or how they are set, guiding principles, a commitment to meet applicable requirements and to keep improving the ISMS, which roles hold which responsibilities, and how exemptions and exceptions are handled; top management signs off any change to it. Beneath it sit topic-specific policies aimed at particular audiences or areas (for example access control, physical security, assets, information transfer, endpoint configuration, networks, incident management, backup, cryptography and keys, classification, technical vulnerabilities and secure development), consistent with the top policy and owned by people with the right authority and expertise. Reviews look for improvement and respond to shifts in strategy, technology, law and contracts, risks, the threat landscape and incident lessons, using management review and audit results, and check related policies for consistency. Policies should be understandable to their readers, acknowledged where appropriate, and screened for confidential content before being shared externally. The top policy is general and approved by top management; topic policies are detailed and approved at a suitable management level.
Source: ISO/IEC 27002:2022, 5.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Change log showing top management approval of every change to the top-level policy · SIEM / log platform
periodic reviewEvidence produced at each review
- Review records showing the planned interval met and ad hoc reviews after changes in strategy, technology, regulation, risk, threats or incidents, with management review and audit results as inputs · Policy repository / GRC workspace
- Acknowledgement records from personnel and relevant external parties that they understand and will comply · HR system / LMS
- Evidence that externally distributed policy versions were checked for confidential content · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure · Policy repository / GRC workspace
- The register of topic-specific policies with an owner, approving manager and version for each · Policy repository / GRC workspace
First move
Common gaps auditors find
- Topic-specific policies referenced in the top policy were never written or have no named owner
- Reviews are calendar driven only and ignore significant incidents or regulatory change
- No procedure exists for handling exemptions and exceptions, so exceptions are granted informally
- Acknowledgement collected once at onboarding and never again after policy revisions
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet